CVE-2026-28512

CVE-2026-28512 identifies a callback URL validation bypass vulnerability in Pocket ID, an OIDC provider, affecting versions 2.0.0 through 2.3.x. This medium-severity flaw (CVSS 6.1) allows an attacker to redirect authorization codes to a controlled host by crafting a malicious redirect_uri containing URL userinfo, requiring user interaction to exploit. Successful exploitation could lead to unauthorized access or information disclosure. There is currently no evidence of active exploitation, public exploit code, or significant community attention. The vulnerability is resolved in Pocket ID version 2.4.0.